docker安装ELK 及springboot 配置

docker安装ELK
sudo docker run -m 2000M -p 5601:5601 -p 9200:9200 -p 5044:5044 -d -it --name elk sebp/elk
sudo docker run -p 5601:5601 -p 9200:9200 -p 5044:5044 -d -it --name elk sebp/elk

进入容器
docker exec -it elk bash
修改
cd /etc/logstash/conf.d/
vim 02-beats-input.conf

input {
  tcp {
      port => 5044
      codec => json_lines
  }
}

output {
  elasticsearch {
      action => "index"
      index => "%{[appname]}-%{+YYYY.MM.dd}"
      hosts => ["localhost:9200"]
      ilm_enabled => true
      ilm_policy => "del"
  }
}

删除多余out文件
rm 30-output.conf

Index Management中添加

  "index_patterns": [
    "logstash-*",
    "tillo*"
  ],
  "settings": {
    "index": {
      "lifecycle": {
        "name": "del"
      },
      "number_of_shards": "1",
      "refresh_interval": "5s"
    }
  }

重启logstash配置将生效
service logstash restart

elk可能出现的报错解决:
sysctl -w vm.max_map_count=262144

spring boot 配置

log配置

    
        172.31.20.141:5044
        
        
            
            {"appname":"tillo_approvice_service_prod"}
        
    

    
    

    
        
        
        
    

maven 配置

        
            net.logstash.logback
            logstash-logback-encoder
            5.3